For the purpose of this invention a Computer Virus is defined as a self-replicating program or routine that spreads on a computer in a possibly modified manner without human interaction. A Computer Worm is defined as a program that can clandestinely send a copy of itself between computers on a computer network, and which uses a network service or services to replicate.
In the field of automated computer virus detection and analysis it is often necessary to predict what type of behavior a program will exhibit so that the program can be replicated and analyzed in the environment most appropriate for the program.
In copending and commonly assigned U.S. patent application Ser. No. 09/640,453, filed Aug. 17, 2000, entitled “Method and Apparatus for Replicating and Analyzing Worm Programs”, William C. Arnold, David M. Chess, John F. Morar, Alla Segal, Morton G. Swimmer, Ian N. Whalley and Steve R. White describe an environment for the automatic replication of worms. In this commonly assigned U.S. patent application these inventors disclose both method and apparatus for dynamically analyzing software, some of whose potentially-important behaviors (such as worm-like behavior) may only be displayed when the software is executed in an environment where the software has, or appears to have, access to a production network and/or to the global Internet. The software may be executed in a real or in an emulated network environment that includes a monitoring component and an emulation component. The monitoring component serves to capture and/or record the behaviors displayed by the software and/or other components of the system, and the emulation component gives the software being analyzed the impression that it is executing with access to a production network and/or to the global Internet. The software being analyzed is effectively confined to the analysis network environment, and cannot in fact read information from, or alter any information on, any production network or the global Internet.
The inventors have realized that it would be desirable to provide a capability to specify the identity of computer worms outside of this environment. While it may be possible to use the disclosed environment for the replication of both computer software viruses and worms, it maybe inefficient, as the worm replication environment assumes the presence of a real or an emulated network that in practice can be expensive to implement.
An ability to predict if a sample of software is a potential worm, outside of the network environment, is expected to reduce the number of samples sent to the worm replication environment, and result in a significant improvement to the efficiency of automated replication and analysis systems. However, prior to this invention this need was not adequately addressed or fulfilled.